There is a KB that details this. It is technically for Netwrix Auditor for Active Directory but the paths and filenames should be similar. Syntax can generally be located within the files themselves: https://www.netwrix.com/kb/1288